Once the server is accepting https connections, to be secure you should make sure the client is actually connecting to the bitcoin server and not an attacker trying to hijack the connection.If you can, you should copy the server.cert certificate chain file to the client machine and use it to validate the OpenSSL connection. For example, in php you would call stream_context_create() with the 'verify_peer' and 'ca_file' options and then call stream_context_set_default().If you can't validate using the server certificate, you should connect to the server using its IP address instead of its host name.